Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
b5e7832464bff54896b1d42a76760dbc_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b5e7832464bff54896b1d42a76760dbc_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
b5e7832464bff54896b1d42a76760dbc_JaffaCakes118
Size
819KB
MD5
b5e7832464bff54896b1d42a76760dbc
SHA1
fb11254b731b5ea1da450ed88e5c3e1b778b2421
SHA256
24e3ea78835748c9995e0d0c64f4f6bd3a0ca1b495b61a601703eb19b8c27f95
SHA512
db873fdb9ae447369c6d229fcfb565f6de339b25c56c3a75ab76a65f6f967783c3c1e45c3dcc7a4491aaddccd4bb8e7cc42ebbbc4181ee888d98ecffd07cbecb
SSDEEP
24576:goRrF58QIiNGqYSFexWltTsEemoBo2TEARcDaixeqbk+VD:goRjhrtFJon55cGA7
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
lstrcpyA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SystemParametersInfoA
CreateCompatibleBitmap
GetServiceKeyNameA
SHGetFolderPathA
CoCreateInstance
listen
WTSQuerySessionInformationA
PathMatchSpecA
DnsQuery_A
GetAdaptersInfo
LsaEnumerateLogonSessions
GetModuleInformation
DestroyEnvironmentBlock
VerQueryValueA
5��1E��%�'`���j���E�e��è|2�ܔ�=�q�p��M��bs�Yw|�K��!�uQ͝$��R���.m5��7�!,0W���w�}^��Q> �jM�({9e��O���;�!䯁ULF�A��=�H:1�?�mHs�9�z:��%(.�hw�q�_��y_�<�uȰޠPcTZ�,�rx�rS�*���!����<bG⽲f�����]���-��!?M:~�������ɨA���ρ��0̇*���,�V�����������=��΅���(�3�O�Dx����w]P�fT��D{#/�p��ˎ����}�<��7���9�6��%ܔ7�Asga����s��:YIt��}�v.�6����ll�Z��i���jVr��q4+�G�&hW�␍DT_���R=q쿰����}����M�ޔ��\ꨄ�G��4����ݞ���������j����N�&��b~� E�2M��ן�sW�@�)��5��UDe9�Ts)r�6eYN�M%��]����s �X�<lmD�;Eh� ���4��7�$�@6�� �օ���S�p҇Ysr����"��x�(��-0K(���)3I�G,g�0�TTE3�%�ZPS�S���� �������e]���`���t�]e�&��L�ܰ�|��?MW��f�6k�ȓ��(���ɰ��⭹���\]W�rH]Lq��Aޥ���b�YQ��d����,[ż�C�U�����n���L!�����kA��Z+2��|�9J/61���b������� Ͱ�p�/��c���;t�&���������x���l3��M�tu;��>�e�>5(LE\G!�p�`O�{+��-�{��8����/i�U?J ����pv��ªF97��}K�zn��Mvk\=k���S�h��C��;�!���r���1��X7|��,� /�����Cm�[.NJ�����i���-RJڟ����T�|���;O�.��4�*�Zq`��ܼ���b:%�"P9g|��[���\�U��E�Fo�`ԃ���4�����I|��P�� �ZC<�_ȋ5a���#��x:Q$��{����F������u�\҃���T|�k�pB��i���_з�<E6�_�;���} �t�p!WC,��w�c���I(q���\�m��*q�� �ϲ��7ݻ�w��p��o(�C�`0�U�g��-L���1��Zȡm�7��v\؊�<����Q���9��)֮Y�_�X h7�7b�q̵di������/���d�I��r&�Y'�Ja��X���ڢ'N�f����?����!��q��ÛAC��u (%��ݖ�9�IY5���L�/�����M���d��Y��#Qȣ�� ٞS8ėp�J^�ox�9��r@�Z?����{�-7������Hd B<�3�仴f��J.�4�ћ�b�"�F��(߯�7�<�P�%Z�;m0�1���+{�!�6 G*Fc+��cϬԧd����.0!/�Ӎ gj�A�9�vܐ�`SkؗRW~{� ��e߉w���d�m}� ��B��Z��e�b���^�8"�Q���1Q<�W.�/��_�>̃J�nH^�2:�s�����ji����� A��+��>��MޯN���܅nj�tt�N���qsO;���5��E�i�F��\୦/{���^-��������!ש�����3�J��)��\�3cf��Q���WiS�j�ռH�ȮmK��I�{[�͘�10��l�.����b2Br{A����T�A2@`k���8s�U���yw,V�{(���؛կ��^�f��.Tk������O0���xЗ����&BDq]d��9���8�>$S�]mX����gjI3���& (>p�����-�g���Y�Y�;�z~�&��>c&�j��?���3�1����p�����i�-�gUޡ瞺����V`ȡ�j.q�N�S�y�BY�x�0Zō���ⴝk.0��0��XIni&Œ�Rv�1�@�� �"���c��2j��5�?�$�i�Ts��� u/y��p�����*2`��^����o�Q��EռS���<V�����)I{����4]�,Z,gӵw�����[���#(G��#�,/�FQ�mZ�����Z���������6�|zβ����.�����ї������f�ώ��o��A��}�Z�Ds?���睗� ^G2I�ل�]��� �M�]���r����)�W9ݧ ��g�)�V�Z�-I�n硛$M�(��I��;9V�8�� ���F�q7&�X�ˆ�����<�~�����������ޝk�`;�������]w��H�bJ?ƚa0��JK�P��CJpCh���\�1�O�T�샂 3�](C{A��o^n���6K?3��=�^��1�!%��wh�u��V��F�!h��r�)+�,�7�r�غ�b��ͭ��P�vH��"�\Ӭ �"�YC���Fx?��� �vF�r�R��A���?% yGJ| DV �e�BD�i�q��:y����,�~Mzlz���"^Ö��O�i�^�e�t�/�$�h�n�l(o{�M~S��m+ <8"n*���K��%/Wy^��i�Z=���B���@��-�w����I���5�����i6H�� �Xv����g=U=�[�Z~�A��,b4X��kꭈGU�5M����ԗù5`(��2"�8����(0����,naCP��"�5����04�0�aa,��R^>q�z��c'�/���;���i���D�BxU�Zܪ��Gw��4GDK��� I+����sǸ۠k���n�S.R��j��Ί}����[�,qI��-��H��������:���O�[`-�\��Ѯ�<��V%��77�E��bctKn'9{_&F@��F��[n��2ۧ>'�4���A��q�"����2��O��Eh����>"xĩ>}[�3SDy���$7����wŗ5sEoKr���Pxr��ü+uWYB��.2�6$}[���"���`>�z���f��o�v��t��|�r� �|�v R�0$�(�כ�L��s�փ��'�!���.
GetModuleFileNameDll
Install
LoadPerfCounterTextStringsW
PerfectWorld
ServiceMain
UnloadPerfCounterTextStringsW
ncProxyXll
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ